Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; extension admits data collection and 3rd-party sharing without extension-specific disclosure.
• Uninstall URL hijack and install URL hijack detected — typical monetization/tracking pattern.
• WhatsApp brand impersonation: confirmed_owner=false, extension built around WhatsApp Web data.
• 10 external JS hosts (wascript.com.br, watools.com.br) contacted from WhatsApp Web context — sensitive messaging data exposure risk.
• function_constructor (new Function) and innerHTML DOM-XSS sink present in content scripts running on WhatsApp Web.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both install and uninstall URL hijacks set; install target is web.whatsapp.com, uninstall target null.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints contacted from WhatsApp Web content-script context.
• function_constructor crx new Function() used in content script running on WhatsApp Web — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script; no CSP to mitigate DOM-XSS on WhatsApp Web.
• no_csp manifest content_security_policy is null (csp_present=false); MV3 default applies but code findings increase risk.
• reputation_signals store Developer 'wsll', email contato@extensao.store, no verified publisher, no featured badge, 471 installs.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local caching.
• storage low Standard key-value storage for extension state.
• alarms low Enables periodic background tasks; low risk alone.
• tabs medium Can read tab URLs and titles; moderate risk when paired with host access.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; narrow but sensitive messaging context.

Pillar Scores

Bookkeeping